16102 2025-12-16 16:50:47 +0000 Document risks and assumptions for shared "downloads" directories 2026-10-22 15:21:06 +0000 1 1 9 Documentation Development Manual development 6.0 x86 Multiple ACCEPTED Medium normal 6.2 1 randy.macleod paul antonin.godard daniel.ammann richard.purdie --- --- Yes (doc changes required) oldest_to_newest 103574 0 randy.macleod 2025-12-16 16:50:47 +0000 In the Dec 16, 2025 YP Tech call, Peter pointed out that for for builds that share the downloads directory, git recipes, could corrupt the local copy of a git clone. I think this involves a malicious user more than two builds racing. Peter plans to document this risk and explain how people should deal with the risk and verify their local downloads directory. 103576 1 peter.kjellerstedt 2025-12-16 16:59:49 +0000 The case we have is that we have a shared download cache. The we have normal CI builds that use it and also official release builds. The assumption has been that it is fine to share the download cache between these types of builds since everything is protected by either Git SHA-1s, or SRC_URI[sha256sum] checksums. However, what we have realized is that a malicious user can modify the actual Git blobs that are stored in the download cache without Git noticing this has happened when fetching the repository into the build tree. Thus the malicious user can run a developer build in CI that does this, and it will later affect an official release build. 105843 2 randy.macleod 2026-06-11 15:20:33 +0000 Do you have a proposal for how we should detect this rather than only documenting the risk? 106459 3 randy.macleod 2026-08-06 15:21:16 +0000 Paul and Richard to write a draft for Antonin.